What happened, in plain English?
On October 21, the PHP team released fixes for two critical security flaws. An attacker could use them to run their own code on the computer hosting an unpatched website, without logging in.[1]
PHP is software that WordPress runs on. A patch is a security fix. Your hosting company controls the PHP version, even if someone else designed your site.[2]
For a contractor, the concern is practical: your website brings in calls, quote requests, and customer details. A server security problem can put those at risk. This alert does not mean your site has already been hacked—but it is a reason to check now.
You cannot tell whether PHP is patched just by opening your homepage. Ask your host to confirm.
YOUR ACTION PLAN
Three things to do today.
- 1
Ask your host to check and patch PHP.
Use the message below. Ask about the PHP version actually running your website, and whether it has both October 21 security fixes. “WordPress is up to date” is a different answer.
- 2
Back up and check compatibility.
Before changing PHP versions, have your host or web developer back up the site and database. Ask them to check your theme and plugins, preferably on a test copy first.[2]
- 3
Test the parts that bring in work.
After the update, send a test quote request and check it arrives. Try photo uploads, booking tools, tap-to-call buttons, and the menu on your phone. Ask your host to confirm the patched software is live.
Can’t get patched promptly? Ask your host how to isolate the affected site until it is fixed. CERT-EU recommends considering isolation when immediate patching is not possible.[3]
Not technical? Send this.
You don’t need to understand server settings to ask the right question.
Replace [my website address] with your own address before sending.
Which PHP versions include the fix?
These are the fixed releases announced on October 21. Ask your host for the latest supported, security-patched version that works with your site.[1]
| PHP version family | Fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Some hosting vendors apply fixes to their own packages, so a version number alone may not tell the whole story. Get confirmation that both flaws are patched.[3]
Running PHP 8.1 or older? Those branches no longer get normal security updates from the PHP project. Ask your host about an upgrade or a verified vendor patch.[1]
The names your host may ask for
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. They affect PHP itself, rather than one particular WordPress plugin. The advisory covers the common ways PHP serves websites.[3]
Where do I find my PHP version?
In WordPress, open Tools → Site Health → Info → Server and look for PHP version.[4] If you cannot find it, send the host message anyway. Your provider can check it for you.
Keep WordPress, your theme, and your plugins updated too. They are separate pieces of software; each needs its own maintenance.
Ready to leave WordPress updates behind?
Move your existing website to Merchuno. Your new site runs without WordPress or PHP, so you won’t have WordPress updates, plugin patches, or PHP upgrades to manage. We handle the hosting and HTTPS.
- Bring your pages, photos, and existing page addresses.
- Keep your current design, or choose a fresh look.
- Review a private preview before you move your domain.
- Keep your existing site live while you decide.
The copy brings over public website content, not your WordPress dashboard or plugin software. Store orders, member accounts, and specialized tools need separate review and setup.
Patch first, even if you plan to move. Keep your current site protected until the switch is complete. A website copy does not fix the old server or clean up an existing compromise.
SOURCES & LAST REVIEW
Based on official guidance.
Reviewed October 21, 2026. Security advice changes; your hosting provider should check the latest advisory before making changes.